3f16780f076eb45bd2fce3aea8a8d0ba545114ea6cc5356646e818c93693f8c3 | Triage

Analysis

max time kernel
148s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:10

Sharing

Report Analysis Logs

General

Target

1e0a3a8e14a03b3ddda9a43b5ceb0215.dll
Size

14KB
MD5

1e0a3a8e14a03b3ddda9a43b5ceb0215
SHA1

fba86a02fac45b782620b14e7b9c2e89c6229ad1
SHA256

3f16780f076eb45bd2fce3aea8a8d0ba545114ea6cc5356646e818c93693f8c3
SHA512

e1a0d689cbcfd1e0eb8e1ccf6d823032373005b7c167997574f230b88464d39e4b6d27a09e75a549a2c73d3b91da39514377fe3f1330f36eada37d802b8987ea
SSDEEP

384:45F5joLDrHQGq+ikzJcrmXXAeEVsg+ax:4H5joLXHW+vc6MHP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 208	4668	rundll32.exe	14
PID 4668 wrote to memory of 208	4668	rundll32.exe	14
PID 4668 wrote to memory of 208	4668	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e0a3a8e14a03b3ddda9a43b5ceb0215.dll,#1
1⤵
PID:208

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e0a3a8e14a03b3ddda9a43b5ceb0215.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download